From: Joe Orton <jorton@apache.org>
Date: Mon, 2 Jun 2025 14:48:53 +0000 (+0000)
Subject: Merge r1924095 from trunk:
X-Git-Tag: 2.4.64-rc1-candidate~71
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3dec975c92ed1e2d5e60c88bbc331edd37ab49d7;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1924095 from trunk:

mod_lua: Fix memory handling in output filters.

* modules/lua/mod_lua.c (lua_output_filter_handle): Fix brigade
  iteration to use constant memory.

Submitted by: G.Grandes <guillermo.grandes gmail.com>
PR: 69590
Github: closes #517
Reviewed by: jorton, rpluem, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1926063 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/changes-entries/pr69590.txt b/changes-entries/pr69590.txt
new file mode 100644
index 00000000000..ebf3f1a5b04
--- /dev/null
+++ b/changes-entries/pr69590.txt
@@ -0,0 +1,2 @@
+  *) mod_lua: Fix memory handling in LuaOutputFilter. PR 69590.
+     [Guillermo Grandes <guillermo.grandes gmail.com>]
diff --git a/modules/lua/mod_lua.c b/modules/lua/mod_lua.c
index ed5c839fe9a..793466ba688 100644
--- a/modules/lua/mod_lua.c
+++ b/modules/lua/mod_lua.c
@@ -473,14 +473,16 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
     L = ctx->L;
     /* While the Lua function is still yielding, pass in buckets to the coroutine */
     if (!ctx->broken) {
-        for (pbktIn = APR_BRIGADE_FIRST(pbbIn);
-            pbktIn != APR_BRIGADE_SENTINEL(pbbIn);
-            pbktIn = APR_BUCKET_NEXT(pbktIn))
-            {
+        while (!APR_BRIGADE_EMPTY(pbbIn)) {
             const char *data;
             apr_size_t len;
             apr_bucket *pbktOut;
 
+            pbktIn = APR_BRIGADE_FIRST(pbbIn);
+            if (APR_BUCKET_IS_EOS(pbktIn)) {
+                break;
+            }
+
             /* read the bucket */
             apr_bucket_read(pbktIn,&data,&len,APR_BLOCK_READ);
 
@@ -514,10 +516,11 @@ static apr_status_t lua_output_filter_handle(ap_filter_t *f, apr_bucket_brigade
                               lua_tostring(L, -1));
                 return HTTP_INTERNAL_SERVER_ERROR;
             }
+            apr_bucket_delete(pbktIn);
         }
         /* If we've safely reached the end, do a final call to Lua to allow for any 
         finishing moves by the script, such as appending a tail. */
-        if (APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) {
+        if (!APR_BRIGADE_EMPTY(pbbIn) && APR_BUCKET_IS_EOS(APR_BRIGADE_LAST(pbbIn))) {
             apr_bucket *pbktEOS;
             lua_pushnil(L);
             lua_setglobal(L, "bucket");